Does your secure site send baseline headers?
It checks selected response headers and recognises some equivalent protections.
What Check Engine measures
The check runs on HTTPS sites. Missing strict-transport-security produces a low finding unless the final host's suffix is in the source's preload list, in which case the code reports a pass for that case. It also checks x-content-type-options and referrer-policy. A nonempty meta referrer declaration in the first 25 successful pages can satisfy the referrer-policy presence test. Missing baseline headers produce a notice. For example, a nonempty meta referrer value in the first 25 successful pages can satisfy that header-presence test.
The check reads saved security headers, the final host and sampled meta declarations. It checks presence and recognised alternatives. Review each value to see whether the policy suits the site.
How to read the result
HSTS absence is low, recognised suffix coverage a pass and missing baseline headers a notice. The report is a focused configuration check, not a complete security assessment of the application.
Why it matters
Equivalent protections can live in different places. Recognising a browser-enforced suffix or an HTML referrer declaration avoids asking for a duplicate solely because a particular response-header key was absent.
How to fix it
Inspect the live response configuration through your normal server tools. Add appropriate baseline values and review HSTS carefully for all hosts it would cover. Keep a valid meta referrer policy where that is the intended configuration. Test representative responses after editing shared server rules, including pages served through another proxy layer.
How to fix missing security headers
What we found in field audits
Problems in Security & trust were found on 14 of the 14 sites we audited. These are area totals. Read the field-audit method.
Method note
backend/seo_engine/checks/security.py, headers, revision 0bb8e8d3.
Common questions
Can a meta referrer declaration satisfy the referrer-policy check?
Yes. The first 25 successful pages are searched for a nonempty meta referrer value. That can satisfy the policy-presence test.
Is missing HSTS always reported when no header is saved?
No. A final-host suffix in the source's preload list gets a pass for that case. Check the actual host and policy separately.
Does passing the header check mean the application is fully secure?
No. It is a focused configuration check. The result cannot complete a broader application security assessment.